Arbitrary File Upload Vulnerability in Request a Quote for WooCommerce

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to an arbitrary file upload flaw, assigned as CVE-2026-18143, affecting all versions up to and including 2.9.2. The vulnerability exists within the afrfq_submit_quote_via_popup() function, which fails to perform server-side validation on file extensions or MIME types during the file upload process. When a site has a public quote rule configured to use the multi-page popup flow, an unauthenticated attacker can supply a malicious PHP file through the request handler. The plugin uses the attacker-provided filename directly when calling move_uploaded_file(), writing the file to a web-accessible temporary directory. Successful exploitation allows an attacker to execute arbitrary code on the underlying web server, posing a critical threat to the integrity and confidentiality of the WordPress environment.

Impact

Successful exploitation of CVE-2026-18143 enables unauthenticated remote code execution on WordPress sites running the vulnerable plugin version. This grants attackers the ability to compromise site data, escalate privileges within the WordPress environment, or gain persistent access to the host server.

Recommendation

• Upgrade the Request a Quote for WooCommerce plugin to the version containing the patch for CVE-2026-18143.
• Implement a web application firewall (WAF) rule to block POST requests containing executable extensions (e.g., .php, .phtml) directed toward the plugin's quote upload endpoint.
• Audit the temporary upload directory for unauthorized scripts if the plugin was previously exposed to the internet.